Re: [PATCH net 1/1] bpf: reject unsafe pointers in TCP congestion control access

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Oct 14, 2026 at 07:57 PM Zhiling Zou <zhilinz@nebusec.ai> wrote:
> bpf_tcp_ca_btf_struct_access() authorizes writes based on the BTF type
> and member offset, but does not check pointer modifiers. A BPF program
> can use bpf_rdonly_cast() to create an untrusted tcp_sock pointer and
> write through an allowlisted member, bypassing the read-only cast.

Not anymore. It was fixed in July. See
commit ac65c710cc64 ("bpf: Reject writes through untrusted BTF pointers")
and the follow up
commit ee9ad135b208 ("bpf: Reject a store through a fault prone pointer").
check_ptr_to_btf_access() rejects such store with
"only read is supported" before it calls any btf_struct_access callback.
progs/tcp_ca_untrusted_btf_write.c is the same prog as your PoC.
All of that is in 7.3-rc1, so net tree has it and this hunk is dead code.

The splat in the cover letter is from 6.12.95.
6.18.y and 7.2.y have ac65c710cc64. 6.12.y and 6.6.y don't.
nf_conn, sched_ext and hid-bpf callbacks in 6.12.y have the same issue,
so patching tcp_ca alone doesn't help there either.
Pls send the backport of ac65c710cc64 to stable instead.

pw-bot: cr